The Purview Workload Content Administrator role for the <redacted> directory was assigned outside of PIM

Question

The Purview Workload Content Administrator role for the <redacted> directory was assigned outside of PIM

Adrian 25

I have the following messages coming in thick and fast - 15 emails so far in the last 15 minutes - I can't see anything added ? do we have as security issue ?

Shubham Sharma 15,685 Reputation points Microsoft External Staff Moderator

2026-05-14T03:10:23.0566667+00:00
Hello Adrian

Thank you for reaching out to Microsoft Q&A.

It looks like those 15 emails in 15 minutes are PIM “Role assigned outside of PIM” security alerts firing on your Purview Workload Content Administrator assignments. By design, whenever someone (or something) assigns a privileged role outside of PIM’s just-in-time workflow, PIM will send an email to your Privileged Role Admins, Security Admins and Global Admins if that alert is enabled.

Here’s how you can investigate and tame the noise:

Check the audit-log details • In the Entra admin center go to Privileged Identity Management → Audit history → filter on “Role assigned outside of PIM.” • Note the “Initiated by” and “Client” fields to see if an automation script, ARM template, Terraform or a service principal is doing the assignment.

Review current Purview role assignments • In the Azure portal open your Purview account → Access control (IAM) → Role assignments → filter by “Purview Workload Content Administrator.” • See who actually holds that role and at what scope.

Decide on your remediation: a. If it’s legitimate automation – Either move that assignment into PIM (make it an eligible assignment instead of permanent) so it stops tripping the alert. – Or exclude that specific “client” in PIM’s alert settings or turn off email notifications for this alert. b. If it’s not expected – Remove the unexpected assignment (via PIM or the portal). – Re-assign through PIM so you get just-in-time approval flow instead of a permanent outside-PIM grant.

Tweak PIM alert settings (if you still want the detection but fewer emails) • In Privileged Identity Management → Alerts settings → locate “Role assigned outside of PIM” → disable or adjust notification recipients and frequency.

Hope that helps you pinpoint who or what is doing the assignment, clean up any unwanted grants, and stop the flood of alerts!

References

• Configure security alerts for roles in PIM: https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts

• View audit history in PIM: https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-how-to-use-audit-log

• Assign Azure resource roles in PIM: https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-resource-roles-assign-roles

• Manage roles you can’t manage in PIM: https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-roles

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".
Adrian 25 Reputation points

2026-05-14T06:07:48.7933333+00:00

Thanks I did some digging more to be done, as I haven't done much with Entra I will go throuugh the audit logs also as suggested as well but it appears that it was due to that account not being used as it is a backup account for the global admin, i couldn't see anything obvious and found an entry which said something along those lines but wasn't able to see additions, appreciate the detailed resonse.

Answer accepted by question author

Vasil Michev 126.8K MVP Volunteer Moderator

Ignore them, most tenants using Purview and PIM have received the same. It's indeed a "noise" event but nothing to be concerned about. Just Microsoft doing Microsoft things.

Adrian 25 Reputation points

2026-05-14T06:10:43.68+00:00

thanks - I hit that conclusion after my blood pressure returned to normal, when I couldn't see anything obviously addded, I need to spend some time with entra....
Graham C 36 Reputation points

2026-05-14T21:02:17.3533333+00:00

We got this too with actor info being type=application and displayname=PurviewRoleAssignmentMigrator. Can confirm the accounts that got it had RBAC assigned in Purview directly. Assuming this is a Msft assignment moving local purview RBAC to entra roles but wish they would have put this in the service notifications. Please confirm if this assumption is incorrect.
Rupert Davey 21 Reputation points

2026-05-18T06:26:09.5533333+00:00

No, never ignore unexpected changed to permissions like this! What an insane thing for an MVP to say. It might not require any action, but it should be checked out and reviewed at a minimum.

2 additional answers

Your answer

Adrian 25 Reputation points

2026-05-14T06:07:48.7933333+00:00

Thanks I did some digging more to be done, as I haven't done much with Entra I will go throuugh the audit logs also as suggested as well but it appears that it was due to that account not being used as it is a backup account for the global admin, i couldn't see anything obvious and found an entry which said something along those lines but wasn't able to see additions, appreciate the detailed resonse.
Adrian 25 Reputation points

2026-05-14T06:10:43.68+00:00

thanks - I hit that conclusion after my blood pressure returned to normal, when I couldn't see anything obviously addded, I need to spend some time with entra....
Graham C 36 Reputation points

2026-05-14T21:02:17.3533333+00:00

We got this too with actor info being type=application and displayname=PurviewRoleAssignmentMigrator. Can confirm the accounts that got it had RBAC assigned in Purview directly. Assuming this is a Msft assignment moving local purview RBAC to entra roles but wish they would have put this in the service notifications. Please confirm if this assumption is incorrect.
Rupert Davey 21 Reputation points

2026-05-18T06:26:09.5533333+00:00

No, never ignore unexpected changed to permissions like this! What an insane thing for an MVP to say. It might not require any action, but it should be checked out and reviewed at a minimum.

Answer 1

Somarribas, Josue 0

Hello everyone,

To identify the user who assigned the role, you can review the activity logs in Microsoft Entra. Navigate to Microsoft Entra and access Audit Logs within the Monitoring and Health section.

Apply a filter for the activity type "Add member to role" to locate the relevant entries. The results will display detailed records of role assignments.
User's image

User's image

Additionally, this process relies on standard Microsoft developer tooling and logging capabilities.
User's image

Tobias Asboeck 5 Reputation points

2026-05-15T08:08:42.19+00:00

The cause is the Microsoft Entra admin roles published last December. My recent blog post covers the current emails: Purview is now assigning workload admin roles in Microsoft Entra

Answer 2

AI answer

Those emails are Privileged Identity Management (PIM) security alerts indicating that the Purview Workload Content Administrator role is being assigned directly in Microsoft Entra ID instead of via PIM. This is treated as a high‑severity event because assignments made outside PIM are not properly monitored and can indicate misuse or an active attack.

What the alert means:

The alert is “Roles are being assigned outside of Privileged Identity Management” for a Microsoft Entra role.
PIM raises this when a privileged role (here, Purview Workload Content Administrator) is assigned outside PIM.
Emails for this alert go to Privileged Role Administrators, Security Administrators, and Global Administrators who have PIM enabled.
Multiple or repeated assignments can generate many emails in a short period.

Immediate checks and actions:

Review the alert details in PIM
- Go to Privileged Identity Management → Alerts → “Roles are being assigned outside of Privileged Identity Management”.
- Review the list of users/service principals that have been assigned the Purview Workload Content Administrator role outside PIM.
Validate each assignment
- Confirm whether each listed assignment is expected and approved.
- If any are unexpected, treat as a potential security incident.
Remediate suspicious or non‑compliant assignments
- For any user or identity that should not have this role, remove them from the privileged role (this is the in‑portal mitigation action described for this alert).
- Then, if access is still required, re‑assign the role via PIM as eligible or active according to policy.
Investigate where the assignments are coming from
- Determine which admin, script, or application is assigning the role directly in Entra ID (for example, via portal, Azure Resource Manager API, or automation).
- Update processes and tools so that privileged role assignments are done through PIM only.
Tune notifications if needed (after investigation)
- If the assignments are legitimate but frequent, the alert and its accompanying email notification can be enabled or disabled in alert settings.
- Do this only after confirming there is no ongoing security issue.

Is this a security issue?

By design, this alert is High severity because assigning privileged roles outside PIM bypasses standard monitoring and controls.
It does not automatically mean a confirmed breach, but it does require immediate review of who received the role and why.

If unexpected assignments are found, follow the organization’s incident response process (containment, investigation of audit logs, and verification of admin accounts and automation).

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Share via

The Purview Workload Content Administrator role for the <redacted> directory was assigned outside of PIM

2 additional answers

Your answer